Method for tracking source and destination internet protocol data

ABSTRACT

In an IP network, tabulating the number of data packets received from and/or sent to a particular IP address over time can provide a mechanism by which it is possible to determine or predict overloading of a node or nodes in an IP data network. By selectively deleting data packets received from a suspect source address or inhibiting the transmission of data packets to a suspect destination address, network management and control can be readily accomplished.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.11/489,838, filed Jul. 20, 2006, now U.S. Pat. No. 7,406,040, which is acontinuation application of U.S. patent application Ser. No. 09/703,699,filed Nov. 1, 2000, now U.S. Pat. No. 7,106,691.

FIELD OF THE INVENTION

This invention relates to data networks. In particular this inventionrelates to a method and an apparatus for managing data flow in anInternet Protocol (IP) network so as to prevent network disruptioncaused by excessive data flow through one or more switches.

BACKGROUND OF THE INVENTION

FIG. 1 depicts a simplified block diagram of a simplified IP datanetwork 100 of the prior art. The IP network 100 allows IP data to besent between network users 120 and 122. A network of IP routers 102,104, 106, and 108 (the purpose, function and operation of which are wellknown in the art) are interconnected by several data paths 110, 112,114, 116, and 118 such that data from a particular customer 120 can berouted to/from other internet protocol data network customer 122 usingany pathway through the network 100 such as coaxial cable, fiber opticcable, microwave data or other appropriate links between the routers.

As an example of a pathway through the network, data from a customer 120might be received at a first router 108 and routed over a data path 118to another router 102 which routes the traffic over the pathway 110 tothe other router 104 connected to the destination address, customer 122.Alternate pathways through the network 100 might route data from router108 through router 102 to router 106 and then to router 104. Yet anotherpathway might exist from router 108 to 106 to 104.

A problem with an IP data network, such as the simplified depiction inFIG. 1, is that one or more individual routers or internet protocol dataswitches can become overloaded by the transmission of data to aparticular destination address or the receipt of too much data from aparticular source address. Curtailing or limiting data to or through arouter might limit the economic losses caused by data that is lostbecause a router is overloaded.

It is well known that IP data packets include both source anddestination addresses, which are numerical indicators of the computer ofthe network from which the data originated and to which a packet is tobe sent. In an internet protocol data system, misdelivered or discardeddata packets that are not received by the destination are retransmittedby the source at the request of the destination when expected datapackets, identified by other data transmitted with each packet, do notarrive.

Another problem with prior art internet protocol data switching networksis the inability to manage or control the flow of data from a particularsource address or to a destination address in order to avoid overloadingone or more routers in a network so as to insure the smooth flow of datapackets through the overall network. A method and apparatus by which aninternet protocol data network can manage the receipt of data from or toan address location would be an improvement over the prior art.

SUMMARY OF THE INVENTION

In an IP data network, source and destination IP addresses are recordedin memory in a router. The data on source and destination addresses ofthe data packets passing through the router are read through a userinterface, or alternatively by a computer, to tabulate the amount ofdata from and to individual IP source and destination addresses.

When the data traffic from or to a particular IP address exceeds apredetermined threshold rate, the router can be controlled to discardmessages either from a particular IP address or to a particular IPaddress via a user interface.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a simplified block diagram of a prior art internet protocoldata network.

FIG. 2 shows a simplified block diagram of an exemplary router devicewith incoming data lines, outgoing data lines and buffer and memorydevices by which source and destination IP addresses are tracked andrecorded.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

FIG. 2 shows a simplified block diagram of an improved internet protocolrouter 200. Incoming data lines 202, 204, and 206 carry internetprotocol data packets, not shown, into the router 200; outgoing datalines 210, 212, 214 carry internet protocol (IP) data packets out of therouter 200.

As is well known to those skilled in the art, IP data packets resembleEthernet data packets in that each includes an address known as a sourceaddress that identifies a computer from which the data packet wasoriginated. Each IP data packet also includes a destination address,which uniquely identifies the destination or end point to which the datapacket is to be routed and delivered.

In FIG. 2 incoming data packets, i.e., data packets arriving on incominglines 202, 204, or 206, are received at one or more data buffers 208within the router 200. The data buffers 208 are typically comprised ofrandom access memory (RAM) or equivalent (perhaps an appropriate fastdisk drive) and provide an elastic storage for the data packets in therouter device 200 that are eventually transmitted on outbound data lines210, 212, and 214 to other points in the IP network.

While IP data packets are resident in the buffer 208 of the router 200,the source and destination IP addresses within each data packet arecopied into or stored into a memory device 216, which acts to accumulatea record of the data traffic through the router 200 over a finite periodof time. By using the accumulated data in the memory device 216, aprocessor, either within the router 200 or outside the router via a userinterface 220, tabulates or counts the occurrence of either or both thesource addresses and destination addresses of data packets passingthrough the router 200.

By counting the occurrences of source addresses and/or destinationaddresses carried through the router 200 over a predetermined timeinterval, the length of which is a design choice, it is possible tomeasure the amount of traffic to and/or from a particular IP address soas to prevent data from a particular router, such as the routers 102,104, 106 or 108 in FIG. 1, from overloading another router in thenetwork.

By way of example, so-called computer hackers, intent on frustrating acomputer network, might cause massive amounts of spurious data to begenerated to or from one or more other routers in the network. Largenumbers of data transmission from one switch (or source address) toanother switch (or destination address) might be attributable to manycauses. (In most instances, hackers cause many switches to send data toone switch to drive it into overload.) By tracking the data origins anddestinations by source and destination addresses, it is possible toprevent such acts from crippling an entire data network if overruns(sometimes referred to as storms of data or data storms) of data arediscarded or suppressed.

In FIG. 2, a user interface 220, which provides access to the datastored in memory 216, allows the accumulated tally of source addressesand destination addresses to be manually read. If the count of sourceand destination addresses per unit time exceeds some predeterminedthreshold, commands entered by the user interface 220 configure therouter 200 to ignore IP data packets from or to, the problematicaddress.

In an alternate embodiment, data traffic volume to or from a particularsource address is monitored automatically. In the unlikely event thatthe source switching system were to be overloaded by an overwhelmingamount of data for a destination address, an intervening router caninhibit the over-loaded switch from bringing a network down byoverloading one or more of the intermediate nodes of the network.

In the preferred embodiment, a running count (or tabulation) of datapackets received from a source address or to be sent to a destinationaddress can be entered via the user interface 220 to the router itself200. Alternate embodiments would certainly include substituting acomputer manager for the user interface 220 such that the computermanager 220 would automatically poll the memory 216 over time to monitorthe rate at which packets are flowing through the router, in the eventthe data from a particular address or to another address exceeded somemanually or automatically determined threshold, both of which could bedetermined either empirically or heuristically; network congestion mightbe avoided by manually or automatically suppressing the reception ofadditional data packets from a particular source or discarding datapackets accordingly. For purposes of claim construction, the manual andautomatic determination of a threshold at which packets might besuppressed or discarded are considered to be equivalent. Similarly, themanual and automatic suppression of packets is considered to beequivalent.

The action of discarding a data packet can be accomplished simply byignoring incoming data packets from a source address. Alternativemethods would include overriding previously stored data packets in abuffer with newly received data packets such that the end result is thatthe total volume of data packets from a source does not exceed somepredetermined allowable threshold. One or more messages might be sentfrom one router to another, instructing the other switch to discardpackets from a particular source. A variant of such an embodiment wouldinclude sending such an alarm message throughout the network so that allswitches connected therein would discard problematic data. As for theinhibition of packet transmission, an overwhelmingly large number ofdata packets addressed to a destination can be controlled simply bydeleting or overriding outbound packets with new or other information.

By monitoring the source address data and the destination address datain an IP protocol network, data overflow on a network might be avoided.By automating the monitoring and maintenance of data traffic through thenetwork, overall system reliability can be increased.

What is claimed is:
 1. A method comprising: sending a message to a firstrouter, the message instructs the first router to override previouslystored data packets in a buffer with newly received data packets, thepreviously stored data packets associated with a time-based trafficmeasure, wherein the first router is not a source router for thepreviously stored data packets, the first router directly interconnectedby a first plurality of data paths to a first sub-plurality ofinterconnected routers from a plurality of interconnected routers, themessage transmitted from a second router responsive to a determinationthat the time-based traffic measure exceeds a predetermined threshold,the determination based upon a tabulation at the second router, thetabulation comprising a plurality of source counts of IP data packets,each source count of IP data packets of the plurality of source countsof IP data packets indicative of a count of packets received from aparticular IP source during a predetermined time interval, the pluralityof source counts of IP data packets associated with every source thatprovides IP data packets to the second router.
 2. The method of claim 1,further comprising: receiving a plurality of IP data packets at thesecond router, the second router directly interconnected by a secondplurality of data paths to a second sub-plurality of interconnectedrouters from the plurality of interconnected routers.
 3. The method ofclaim 1, further comprising: tabulating the plurality of source countsof IP data packets.
 4. The method of claim 1, further comprising:tabulating at the second router a plurality of destination counts of IPdata packets, each destination count of IP data packets of the pluralityof destination counts of IP data packets indicative of a count ofpackets routable to a particular IP destination address during thepredetermined time interval.
 5. The method of claim 1, furthercomprising: storing each of the plurality of source counts in a memorydevice for subsequent processing.
 6. The method of claim 1, furthercomprising: determining that the time-based data traffic measure exceedsthe predetermined threshold, the time-based traffic measure based upon aparticular destination count of a plurality of destination counts. 7.The method of claim 1, further comprising: reading the time-basedtraffic data measure from a memory device.
 8. The method of claim 1,further comprising: denying reception of IP data packets based upon themessage.
 9. The method of claim 1, further comprising: sending an alarmto all switches connected to a network comprising the second router, thealarm causes each of the switches to discard IP data packets addressedas being from the particular IP source.
 10. A method comprising: sendinga message to a first router, the message instructs the first router todiscard packets associated with a time-based traffic measure of packetsand a particular IP destination, wherein the first router is not asource router for the packets, the first router directly interconnectedby a first plurality of data paths to a first sub-plurality ofinterconnected routers from a plurality of interconnected routers, themessage transmitted from a second router responsive to a determinationby the second router that the time-based traffic measure exceeds apredetermined threshold, the tabulation comprising a plurality ofdestination counts of IP data packets, each destination count of IP datapackets of the plurality of destination counts of IP data packetsindicative of a count of packets routable to the particular IPdestination address during a predetermined time interval.
 11. The methodof claim 10, further comprising: receiving a plurality of IP datapackets at the second router, the second router directly interconnectedby a second plurality of data paths to a second sub-plurality ofinterconnected routers from the plurality of interconnected routers. 12.The method of claim 10, further comprising: tabulating the plurality ofdestination counts of IP data packets.
 13. The method of claim 10,further comprising: tabulating at the second router a plurality ofsource counts of IP data packets, each source count of IP data packetsof the plurality of source counts of IP data packets indicative of acount of packets received from a particular IP source during thepredetermined time interval, the plurality of source counts of IP datapackets associated with every source that provides IP data packets tothe second router.
 14. The method of claim 10, further comprising:storing each of the plurality of destination counts in a memory devicefor subsequent processing.
 15. The method of claim 10, furthercomprising: determining that the time-based data traffic measure exceedsthe predetermined threshold, the time-based traffic measure based upon aparticular source count of a plurality of source counts.
 16. The methodof claim 10, further comprising: selectively discarding IP data packetsreceived at the first router responsive to the determination that thetime-based data traffic measure exceeds the predetermined threshold, thetime-based traffic measure based upon a particular destination count ofthe plurality of destination counts.
 17. The method of claim 10, furthercomprising: selectively discarding IP data packets responsive to themessage.
 18. The method of claim 10, further comprising: denyingreception of IP data packets based upon the message.
 19. The method ofclaim 10, further comprising: automatically polling a memory over timeto monitor a rate at which packets are flowing through the secondrouter, the message sent responsive to the rate.
 20. The method of claim10, further comprising: sending an alarm to all switches connected to anetwork comprising the second router, the alarm causes each of theswitches to discard IP data packets addressed as being sent to theparticular IP destination address.
 21. A method comprising: sending amessage to a first router, the message instructs the first router todiscard previously stored data packets in a buffer, the previouslystored data packets associated with a time-based traffic measure,wherein the first router is not a source router for the previouslystored data packets, the first router directly interconnected by a firstplurality of data paths to a first sub-plurality of interconnectedrouters from a plurality of interconnected routers, the messagetransmitted from a second router responsive to a determination that thetime-based traffic measure exceeds a predetermined threshold, thedetermination based upon a tabulation at the second router, thetabulation comprising a plurality of source counts of IP data packets,each source count of IP data packets of the plurality of source countsof IP data packets indicative of a count of packets received from aparticular IP source during a predetermined time interval, the pluralityof source counts of IP data packets associated with every source thatprovides IP data packets to the second router.